Articles Tagged “Security”
37 articles tagged “Security”, newest first.
-
Does Turning Off Memory Integrity (HVCI) Make Windows Faster? — What It Means, How to Do It, and How to Decide
Does turning off Memory integrity (HVCI) really speed up a Windows PC? When it can help, when it cannot, how to switch it off and back, and how to decide.
-
The Depths of Windows Virtualization (Part 2) — Memory Even the Kernel Cannot See: How VBS, HVCI, and Credential Guard Work
Enabled by default on a clean install to compatible hardware, VBS uses the hypervisor and SLAT to isolate beyond the kernel. Covers VTLs, the Secure Kernel, ...
-
Named Pipes in Practice — Windows' Standard IPC from Design to Security
A practical guide to named pipes, Windows' standard IPC. Covers byte vs. message mode, servers that handle multiple clients, ACL and impersonation security, ...
-
Choosing a Windows Service Account — LocalSystem, Virtual Accounts, and gMSA
Still running Windows services as LocalSystem? Compare LocalService, NetworkService, virtual accounts, domain users, and gMSA by privileges and network ident...
-
Windows Security Audit Policy and Event Log Investigation in Practice — Becoming an IT Team That Can Read Event 4625
A practical guide for "look into the failed sign-in logs": basic versus advanced audit policy, subcategories to enable, 4624/4625/4688, Security log sizing, ...
-
A Practical Guide to Windows LAPS — Retiring the Shared Local Administrator Password Across All PCs
A shared local admin password lets one compromised PC spread to all via Pass-the-Hash. This guide covers Windows LAPS rotation, AD/Entra ID storage, and oper...
-
The Windows Certificate Store in Practice — User or Computer, Which Should You Use?
Should a client certificate go in the user or computer store? A practical guide to certmgr.msc vs certlm.msc, private key permissions, and PowerShell expiry ...
-
The Windows Firewall and Business Applications — Register Inbound Rules From the Installer
When a Windows business app cannot communicate on site, triage inbound rules, listening, profiles, and managed policy. Covers rule design, installer registra...
-
Windows Update Management After WSUS Deprecation — How to Choose Between WUfB, Autopatch, and Intune
Deprecated in September 2024, WSUS still runs but gains no new features. A decision table weighs WSUS, Windows Update for Business, Autopatch, and Intune, li...
-
BitLocker Practical Guide — How to Find the Recovery Key and Manage It Safely
Where is the BitLocker recovery key? Find it from the recovery screen, tell encryption percentage from protection status, and manage company keys, updates, a...
-
Why Passkeys Are Secure — How They Work, How They Sync, and What to Watch for If You Lose a Device
Why passkeys are secure, from registration to login: phishing resistance, synced vs. device-bound, revocation and recovery after a loss, plus WebAuthn and Wi...
-
The Depths of Windows I/O (Part 6, Final) — How Minifilters Work and Investigating Slow I/O with Procmon
Explains how minifilters monitor and control file I/O: FltMgr, altitudes, pre/post callbacks, fltmc, finding slow operations in Procmon, plus exclusion and D...
-
AppLocker, App Control for Business (WDAC), and Business App Distribution — Before Application Control Blocks You
Compares AppLocker, App Control for Business (formerly WDAC), and Smart App Control, and covers how to avoid blocks on business apps and how to read the even...
-
SMB Signing and LDAP Channel Binding — Closing the "Other Half" of NTLM Defense in Practice
SMB signing and LDAP signing/channel binding limit relay damage while you retire NTLM. We cover OS defaults, audit events, enforcement, and how to fix apps a...
-
NTLM and Kerberos Explained with Diagrams — Why Authentication Falls Back to NTLM
Diagrams compare NTLM and Kerberos: challenge/response, TGTs and service tickets, Negotiate's NTLM fallback without an SPN, relay attacks, Pass-the-Hash, and...
-
Will NTLM Deprecation Stop Your Business Apps? — How to Collect Audit Logs, and the Order in Which to Kill Dependencies
This article covers how to find where Windows and business apps depend on NTLM: audit policies, NTLM/Operational events 8001-8004, causes and fixes, and SMB ...
-
What Is the TPM in Windows? — An Illustrated Guide to the "Safe That Never Lets Keys Out" and Measured Boot
An illustrated TPM guide. It covers keys that never leave the chip, PCRs and Measured Boot, BitLocker and Windows Hello, dTPM, fTPM and Pluton, Get-Tpm, and ...
-
Hardening PowerShell — Logging, AMSI, Language Modes, and JEA
Use PowerShell safely instead of banning it. This guide covers script block logging and transcription, AMSI, disabling old versions, language modes, and JEA ...
-
An Introduction to Microsoft Graph PowerShell — Running Microsoft 365 After the Retirement of AzureAD and MSOnline
A practical guide to migrating Microsoft 365 operations to Microsoft Graph PowerShell now that the AzureAD and MSOnline modules have been retired: connecting...
-
Handling Credentials Safely in PowerShell — Banishing Plaintext Passwords from Your Scripts
A practical walkthrough of moving plaintext passwords out of PowerShell scripts and into safe storage: what SecureString really is and where it stops, how Ex...
-
Taking Inventory of a File Server with PowerShell — Capacity Analysis and Access Permission (ACL) Auditing
A practical procedure for taking inventory of a file server with PowerShell. Covers capacity analysis and recording access denials, listing old files and ext...
-
An Introduction to PowerShell Remoting (WinRM) — Managing Multiple Windows Machines at Once
An introduction to managing multiple Windows machines at once with PowerShell Remoting (WinRM). Covers how it works and ports 5985/5986, what Enable-PSRemoti...
-
PowerShell Execution Policy and Script Signing — A Practical Guide to Graduating From "Papering Over It With Bypass"
PowerShell's execution policy is "a safety feature, not a security boundary." This article covers the differences between policies like RemoteSigned, scope p...
-
When Your In-House Windows App Gets Flagged as a Virus — Handling Microsoft Defender False Positives and Living With the Performance Impact
We lay out the proper way to respond when Microsoft Defender flags your in-house Windows app as malware: how modern antivirus detection actually works, how t...
-
Integrating Entra ID Authentication into WinForms/WPF Apps — A Practical Architecture with MSAL.NET and the WAM Broker
A practical, hands-on look at integrating Entra ID (formerly Azure AD) authentication into WinForms/WPF desktop apps: the public client mindset, where ROPC s...
-
What to Do Before Disposing of a Windows PC — A Practical Checklist for Data Erasure, Account Unlinking, and Backups
What to do before disposing of, transferring, selling, or returning a leased Windows PC — covering backups, data erasure, BitLocker, Microsoft accounts, OneD...
-
Handling Windows Impersonation Tokens Correctly — Borrowing Privileges per Thread and Reverting Safely
A practical guide to Windows impersonation tokens — access tokens, primary tokens, thread tokens, impersonation levels, RevertToSelf, and .NET's WindowsIdent...
-
Why Windows Became What It Is Today: The Evolution of Windows Through a Developer's Eyes
A look at the changes from Windows 95 to Windows 11 — not as a visual timeline, but from a Windows application developer's perspective: compatibility, stabil...
-
Why Windows Shows "Windows protected your PC"
Why SmartScreen warns when you distribute a Windows app, organized from a practitioner's perspective: code signing, EV/OV certificates, Azure Artifact Signin...
-
Pseudo-Random vs. True Random Numbers - How Do You Actually Tell Them Apart?
Pseudo-random vs true random numbers (physical randomness / NRBG), compared on reproducibility, predictability, entropy sources, statistical testing, and whi...
-
Security Design for Auto-Update - Why HTTPS Alone Is Not Enough
We treat auto-update as a trust boundary and walk through signed metadata, client-side verification, key separation, rollback protection, and fail-closed des...
-
A Practical Procedure for Identifying the Scheme Behind a Hash String
When identifying the scheme behind a hash string left in logs or a DB, it helps to look at the prefix, separators, character set, and length, in that order. ...
-
How Windows DLL Name Resolution Works - Search Order and SxS
A practical guide to DLL name resolution on Windows: the DLL search order, Known DLLs, the loaded-module list, API sets, SxS manifests, and how the LoadLibra...
-
When Do You Actually Need Administrator Privileges on Windows? - UAC, Protected Areas, and How to Tell by Design
A practical look at when administrator privileges are required on Windows, from the perspectives of UAC, protected areas, services, drivers, and per-user/per...
-
How to Concretely Isolate "Only the Operations That Need Administrator Privileges" in a Windows App
A concrete walkthrough of keeping a Windows app UI at asInvoker while isolating only the administrator-privileged operations into a helper EXE, covering UAC,...
-
Storing Secrets in Windows Apps - Avoiding Plaintext Configuration with DPAPI
To avoid storing connection credentials and API tokens in plaintext configuration files in Windows apps, we walk through DPAPI / ProtectedData, the differenc...
-
A Minimum Security Checklist for Windows App Development
A checklist-style guide to the security basics for WPF / WinForms / WinUI / C++ / C# business apps: privileges, signing, updates, secrets, HTTPS, input valid...